Mosul University WLAN Security: Evaluation, Analysis and Improvement
Total Page：16
File Type：pdf, Size：1020Kb
ﺍﻟﻤﺠﻠﺔ ﺍﻟﻌﺮﺍﻗﻴﺔ ﻟﻠﻬﻨﺪﺳﺔ ﺍﻟﻜﻬﺮﺑﺎﺋﻴﺔ ﻭﺍﻻﻟﻜﺘﺮﻭﻧﻴﺔ Iraq J. Electrical and Electronic Engineering ﻣﺠﻠﺪ7, ﺍﻟﻌﺪﺩVol.7 No.2, 2011 2011 ,2 ________________________________________________________________________________________________________________________ oc s e a o a Co e gy, o e a d Co o as a U e s y, as a , aq 30 o o ec 0 0 Mosul University WLAN Security: Evaluation, Analysis and Improvement Omar Ahmed Hachum Faculty Computer Eng. Dept., Engineering College Mosul University, Iraq Email: [email protected] Abstract— In this paper, Mosul University Wireless Local II. HARDWARE/SOFTWARE USED IN THE Area Network (MUWLAN) security will be evaluated. The EVALUATION evaluation was made to test the confidentiality, integrity and availability of the MUWLAN. Addressing these issues will help in ensuring tighter security. After the evaluation, serious The equipments used in this evaluation are security pitfalls were found that can allow any attacker to have access to the MUWLAN and uses their internet service. 1. Omni-directional antenna: Based on the obtained results, suggestions for improvement Gain: 15dBi. were made to tighten the security of Mosul University wireless Operating frequency: 2.4GHz. local area network. 2. Coaxial cable: Type: LMR 400. Keyword: - WLAN security, WEP encryption, PTW attack, Length: 15m. Wireshark, MITM attack, SSLStrip attack. 3. Wireless LAN card: D-Link DWL-G520 High Speed PCI I. INTRODUCTION Adapter (rev B). 802.11b/g compatible. Wireless access is quickly broadening network reach 4. Workstation with a linux-backtrack3 operating by providing convenient, and inexpensive access in hard- system (Linux version 2.6.21.5, gcc version 4.1.2) to-wire locations. Users are clamoring for WLAN access, installed in it. because it allows them to access their network and the Internet from anywhere in the workplace, without having Softwares that will be mentioned later in this paper can the wire environment. Administrators are attracted to be found pre installed in the operating system except for WLAN because they are easier to install, flexible, and less SSLStrip software. expensive to maintain over the long term. WLAN has already made significant penetration into the education, hospitality, healthcare and financial industries, and III. EVALUATION PROCEDURE continually decreasing equipment prices should help drive adoption in other industries. As with any technology shift, This section will explain the main steps that have been migrating users to WLAN has its chief drawbacks concern. used to evaluate MUWLAN security. The chief concern is security problems [1]. A. Identifying Network SSID The term information security covers a wide array of activities in an organization. The design goals of a The Service Set Identifier (SSID), also known as the security topology must deal with issues of confidentiality, wireless network name, identifies the wireless network. The integrity, availability, and accountability. Addressing these SSID is a name configured on the wireless Access Point four issues as an initial part of the network design will help (AP) (for infrastructure mode) or an initial wireless client to ensure tighter security. It is often to see confidentiality, (for ad hoc mode) that identifies the wireless network. The integrity, and availability referred to as the CIA of network SSID is periodically advertised by the wireless AP or the security, but the accountability component is equally initial wireless client using a special 802.11 MAC important, design goals must identify who is responsible for management frame known as a beacon frame. One way to the various aspects of computer security [2]. limit the visibility of a wireless network is to hide the SSID. Without knowing the SSID, client cannot send the In this paper, Mosul University Wireless Local association request frame to gain access to the WLAN [2]. Area Network (MUWLAN) will be evaluated to address the CIA network security principles [3][4][5]. Results was deleted or replaced with the symbol $ for security purposes. 138 ﺍﻟﻤﺠﻠﺔ ﺍﻟﻌﺮﺍﻗﻴﺔ ﻟﻠﻬﻨﺪﺳﺔ ﺍﻟﻜﻬﺮﺑﺎﺋﻴﺔ ﻭﺍﻻﻟﻜﺘﺮﻭﻧﻴﺔ Iraq J. Electrical and Electronic Engineering ﻣﺠﻠﺪ7, ﺍﻟﻌﺪﺩVol.7 No.2, 2011 2011 ,2 ________________________________________________________________________________________________________________________ The first main step was to capture and reveal all the wlan.bssid == 00:60:b3:$$:$$:$$ (2) network’s SSID transmitted through the air. Since the management frames used in the 802.11 has no means of TABLE 2 security, the attacker can easily gain useful information SSID’s containing the phrase Mosul University was captured in the range of the testing omni-directional antenna. about the WLAN. The SSID will be unhided simply by SSID MAC address analyzing 5 subtype frames of the main management frame as shown in Table 1. M0SUIUniVersiTy$$$$$ 00:60:B3:$$:$$:$$ TABLE 1 M0SUI0FUNlVeri$$$$$ 00:60:B3:$$:$$:$$ The Frame Body contents of a management frame depends on the frame subtype. [6]. M0SUIUNlVerSlT$$$$$ 00:60:B3:$$:$$:$$ M0SuLUniversiT$$$$$ 00:60:B3:$$:$$:$$ M0SUIUNlVersiT$$$$$ 00:60:B3:$$:$$:$$ In the captured data, the protected flag data was set to 1 so the data was WEP encrypted. The index key that was used to encrypt the data was key number 2 (starting from 0) as shown in Figure 1. The WLAN card will capture all the frames in the air when it is operating in the monitor mode. The captured Figure 1 : Management frame captured using wireshark software showing wireless data is protect and the key number used to encrypt data. frames will be huge due to the fact the there are many wireless network broadcasting in Mosul City. Wireshark software [7], which will be pre installed under the operating B. Cracking WEP system, will be used to capture and filter the wireless traffic. The following filter will be used to instruct the The IEEE 802.11 standard defines the Wired wireshark to filter (i.e keep) frames contains subtypes Equivalent Privacy (WEP), encapsulation of 802.11 data number 0,2,4,5 and 8 (see Table 1). frames. The goal of WEP is to provide data privacy to the level of a wired network. wlan.fc.type_subtype == 0x00 || wlan.fc.type_subtype == 0x02 || Encryption in WEP uses a secret key, k, shared wlan.fc.type_subtype == 0x04 || between an access point and a mobile node. To compute a wlan.fc.type_subtype == 0x05 || WEP frame, the plaintext frame data, M, is first wlan.fc.type_subtype == 0x08 (1) concatenated with its checksum c(M), to produce M • c(M) (where • denotes concatenation). Then, a per packet The wireshark will be used to capture all the initialization vector (IV) is prepended to the secret key, k, frames in the airwave channels ranging from (1~13). After to create the packet key, IV • k. The RC4 stream cipher is a while, all the SSIDs in the range of the omni-directional then initialized using this packet key, and the output bytes antenna were revealed. After reviewing all the SSID names. of the cipher are exclusive-ored (denoted ) with the Table 2 summarizes all the APs with the SSID’s including checksummed plaintext to generate the ciphertext [8]: the phrase Mosul University. C = (M • c(M)) RC4(IV • k) Upon identifying more than one AP that belongs to the MUWLAN, one AP will be selected to penetrate The extension of Klein's attack which is optimized for MUWLAN. The AP with the following SSID usage against WEP [9], also known as PTW attack (PTW M0SuLUniversiTy$$$$$ will be selected. To find if this AP stands for the initial letters from the names of this attack uses any mean of data encryption. The data frames sent and creators, Andrei Pyshkin Erik Tews , Ralf-Philipp received by this AP will be captured by applying the Weinmann ,) was used on MUWLAN and that attack can following filter to the captured data. be easily done by using aircrack-ng software on enough 139 ﺍﻟﻤﺠﻠﺔ ﺍﻟﻌﺮﺍﻗﻴﺔ ﻟﻠﻬﻨﺪﺳﺔ ﺍﻟﻜﻬﺮﺑﺎﺋﻴﺔ ﻭﺍﻻﻟﻜﺘﺮﻭﻧﻴﺔ Iraq J. Electrical and Electronic Engineering ﻣﺠﻠﺪ7, ﺍﻟﻌﺪﺩVol.7 No.2, 2011 2011 ,2 ________________________________________________________________________________________________________________________ captured encrypted data packets. After capturing enough the wireless client MAC address can be found as shown in data and applying PTW attack, WEP key for the SSID Figure 3. M0SuLUniversiTy$$$$$ used by the MUWLAN AP is found and as shown in Figure 2. Figure 3 : The WLAN IP address and MAC address of one MUWLAN client. B. Network subnet mask Figure 2 : WEP key was found using PTW attack on enough captured data. Since there is no DHCP server, finding subnet mask will be Now all the capture data traffic from tricky. The following filter will be applied to the wireless M0SuLUniversiTy$$$$$ can be decrypted using the WEP traffic to capture only the broadcast traffic (destination key. The idea now is to consume the identity of a MAC address equals all 1’s) on the network. MUWLAN client and enters the MUWLAN when the client is offline. wlan.bssid == 00:60:b3:$$:$$:$$ && wlan.da == ff:ff:ff:ff:ff:ff && IV. WLAN PACKETS ANALYSIS ip.dst >= 172.20.0.1 && ip.dst<= 172.20.255.255 (5) After the WEP key was found, the attacker can now analyze all the traffic (data) between the wireless clients This can be accomplished by checking the and the AP. To have the right to use the services provided destination IP address of that broadcast packets as shown in by the MUWLAN, such as the internet service, the Figure 4. configuration of the MUWLAN wireless client must be known and they are: IP and MAC address. Subnet mask. IP address of the gateway. IP address of the DNS server. The easiest way to find these parameters is to search for DHCP packets replies or offers in the captured data. So the following filter will be applied to the captured data: wlan.bssid == 00:60:b3:$$:$$:$$ && bootp.type == 2 (3) Unfortunately for the attacker, no DHCP replies or offers packed was captured. A. IP and MAC address.